Is there a debugger that allows you to breakpoint with conditions?

Question

Windows

There is someone else's program that is running and running on the windows operating system. I want to debug and stop the program when a certain condition is met. Let's say the sum of registers eax+ebx will be equal to 65463. Is there any debugger that allows you to control debugging programmatically?

Answer 1

I want to debug and stop the program when a certain condition is met. Let's say the sum of the eax+ebx registers is 65463.

For a completely arbitrary condition, such as what you wrote, there are most likely no ready-made tools.
If you need to stop when a program variable in memory takes on a certain value, search your debugger for the word watchpoint. In gdb, for example, you can put a watchpoint on a variable, and in commands enter code that will continue execution if the value of the variable is not what you need, for example:

$ cat > main.c
int v;

static void f(int *p)
{
        int i;

        for (i = 0; i < 20; ++i)
                *p = (i - 10) * (i - 10);
}

int main()
{
        f(&v);
        return 0;
}
$ gcc -g2 -o watch main.c     
$ gdb ./watch              
...
Reading symbols from ./watch...done.
(gdb) start
Temporary breakpoint 1 at 0x4004ec: file main.c, line 13.
Starting program: /home/jcmvbkbc/tmp/toster/watch/watch 

Temporary breakpoint 1, main () at main.c:13
13              f(&v);
(gdb) watch v
Hardware watchpoint 2: v
(gdb) commands 
Type commands for breakpoint(s) 2, one per line.
End with a line saying just "end".
>if (v != 4)
 >continue
 >end
>end
(gdb) c
Continuing.
...
Hardware watchpoint 2: v

Old value = 9
New value = 4
f (p=0x600904 <v>) at main.c:7
7               for (i = 0; i < 20; ++i)
(gdb)

Answer 2

These are called conditional breakpoints. Many debuggers can.
Windbg: https://msdn.microsoft.com/en-us/library/windows/h...
Visual Studio: https://msdn.microsoft.com/en-us/library/7sye83ce(...

Answer 3

In OllyDbg 2.* you can do this in tracing mode. Trace->Set condition and in the Condition rule # field just write eax+ebx=65463. After that, press Ctrl + F11 (Trace into) and wait a long time.